Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
1474Microsoft CVEsreleased Tue 13 Oct
94Critical81 need an update · 13 fixed service-side
1Exploited in the wild
1Publicly disclosed
1In CISA KEV
256Revised since release
September 2026: 998 CVEs · 132 critical · 2 exploited · 2 in CISA KEV
Act first · October 2026
Exploited, KEV-listed, or publicly disclosedPatch next · critical, "exploitation more likely", or top 5% EPSS · needs an update183
Showing 3 of 183All critical
| CVE | Vulnerability | Severity | CVSS | EPSS | Impact | Status | Fixed by |
|---|---|---|---|---|---|---|---|
| CVE-2026-85891 | Azure HDInsight Information Disclosure VulnerabilityAzure HDInsight | Important | 7.5 | 0.9% | Information DisclosureNetwork | — | |
| CVE-2026-100207 | Azure CycleCloud Remote Code Execution VulnerabilityAzure CycleCloud | Important | 7.3 | 0.4% | RCELocal | — | |
| CVE-2026-69877 | Azure DevOps Information Disclosure VulnerabilityAzure DevOps | Important | 6.5 | 0.5% | Information DisclosureNetwork | — | |
| CVE-2026-96204 | Azure Arc Elevation of Privilege VulnerabilityAzure Arc | Important | 6.5 | 0.8% | EoPNetwork | — | |
| CVE-2026-110063 | VM Inspector for Azure Virtual Machines Elevation of Privilege VulnerabilityVM Inspector for Azure Virtual Machines | Critical | 10.0 | 0.9% | EoPNetwork | Service-side fix | |
| CVE-2026-83938 | Azure Kubernetes Configuration Service Elevation of Privilege VulnerabilityAzure Kubernetes Configuration Service | Critical | 10.0 | 0.7% | EoPNetwork | Service-side fix | |
| CVE-2026-96207 | Microsoft Partner Center Elevation of Privilege VulnerabilityMicrosoft Partner Center | Critical | 10.0 | 0.7% | EoPNetwork | Service-side fix | |
| CVE-2026-97785 | AAD App Proxy Elevation of Privilege VulnerabilityAAD App Proxy | Critical | 10.0 | 0.6% | EoPNetwork | Service-side fix | |
| CVE-2026-77900 | Azure App Service Remote Code Execution VulnerabilityAzure App Service | Critical | 9.8 | 0.7% | RCENetwork | Service-side fix | |
| CVE-2026-69435 | Azure SRE Agent Elevation of Privilege VulnerabilityAzure SRE Agent | Critical | 9.6 | 0.6% | EoPNetwork | Service-side fix | |
| CVE-2026-83943 | Azure API Center Information Disclosure VulnerabilityAzure API Center | Critical | 8.7 | 0.5% | Information DisclosureNetwork | Revised 14 Oct | Service-side fix |
| CVE-2026-108456 | Azure AI Foundry Elevation of Privilege VulnerabilityAzure AI Foundry | Critical | 7.7 | 0.7% | EoPNetwork | Service-side fix |
Advisories · October 2026
MSRC guidance without a CVE of its own · 1 advisory
Hardening changes for ReFS volumes on removable mediaStarting with Windows updates released on and after October 13, 2026, Microsoft is making hardening changes to the Resilient File System (ReFS) . This change is not enable by default until 2027. Please see Hardening changes for ReFS volumes on removable media for more information.